GLSA-200405-09 : ProFTPD Access Control List bypass vulnerability
High Nessus Plugin ID 14495
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200405-09 (ProFTPD Access Control List bypass vulnerability)
ProFTPD 1.2.9 introduced a vulnerability that allows CIDR-based ACLs (such as 10.0.0.1/24) to be bypassed. The CIDR ACLs are disregarded, with the net effect being similar to an 'AllowAll' directive.
This vulnerability may allow unauthorized files, including critical system files to be downloaded and/or modified, thereby allowing a potential remote compromise of the server.
Users may work around the problem by avoiding use of CIDR-based ACLs.
SolutionProFTPD users are encouraged to upgrade to the latest version of the package:
# emerge sync # emerge -pv '>=net-ftp/proftpd-1.2.9-r2' # emerge '>=net-ftp/proftpd-1.2.9-r2'